Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An AI coding agent’s view of a project depends on the product, the active session, its tools and settings, and where it runs. It may use workspace files, IDE context, search results, URLs, or tool responses—but visibility is not the same as permission to edit, run commands, reach the network, or use connected services. Check both the information available to the agent and the actions it is allowed to take before assigning work.
What can an AI coding agent see?
There is no universal answer. An agent may receive information from files it reads, project indexes, the prompt, IDE context, search, URLs, connected tools, or services such as configured MCP servers. Which sources are available can vary by product, IDE, settings, and session. Nor does access necessarily mean every project file is sent in full to a remote service.
For example, Google’s Gemini Code Assist documentation lists different context sources for VS Code and IntelliJ, and says users can inspect available context in the agent-mode context drawer. In VS Code, listed sources include workspace information, tool responses, Google Search responses, URL content, and Markdown context files. In IntelliJ, they include project files, indexed symbols and usages, version control, tool responses, configured MCP servers, and context files. The agent may request tools, whose results are returned to the Gemini API during its action-and-evaluation cycle. Google’s agent mode overview describes the product-specific details.
Claude Code’s FAQ makes a different, vendor-specific statement: “Source files are read locally, and only the portions needed for the current task are sent to the API to generate a response.” It also says Claude Code does not scan the whole repo. Do not assume that description applies to other products. Claude Code’s FAQ explains its stated data handling and settings.
#1 Best Overall
Seeing information is different from being able to act
Assess context and authority separately. An agent might be able to read a file without being allowed to change it; it might be permitted to edit files but need approval to run a shell command; network access or access to an integrated service may have its own controls. The actual boundaries depend on the product and configuration.
- Context: Which project files, attached materials, indexed information, prompts, URLs, and tool results can inform the response?
- Read and write access: Which paths can the agent read, which can it modify, and are any paths explicitly denied?
- Execution: Can it run commands, and do those commands require approval or run under a sandbox?
- Network and integrations: Can it make network requests or use configured tools and connected apps?
- Runtime: Is it operating on your machine, in a container, or in a provider-managed cloud environment?
These distinctions matter because an agent’s tools can introduce information beyond the files currently open in the editor. Likewise, permission to act in one environment does not establish what is available in another.
Check the active session before assigning work
- Identify the product and surface. Check whether you are using an IDE agent, terminal CLI, desktop app, or cloud task. The available context and controls can differ between surfaces and organization settings.
- Inspect the context sources. Look for the open workspace or project, attached context, IDE information, the available context drawer, tool list, configured MCP servers, URLs, and app integrations. In Gemini Code Assist agent mode, Google says the context drawer shows context available to the agent.
- Check read and write boundaries. Find which paths are readable and writable, whether specific files are denied, and what approval is needed for edits or commands. Codex CLI’s
/permissionsinterface lets users inspect the active sandbox and writable roots; Anthropic documents Read deny rules in.claude/settings.json. - Confirm where the agent runs. Establish whether it uses your local machine, a container, or a cloud environment, and what repositories, credentials, tools, and network routes are available there. Do not infer the cloud task’s filesystem from what is present in your local session.
- Start narrowly and inspect activity. Give the agent a limited task, then examine the commands it ran and the resulting diff before expanding access. Approval prompts are useful controls, not a guarantee that every possible data exposure is prevented.
How the controls differ across products
Codex CLI and Codex Cloud
The Codex CLI guide describes inspecting code, making changes, running commands, and using local development tools. It says users can steer the task, review commands and diffs, and use /permissions to choose what Codex may do; the interface shows the active sandbox and writable roots. Defaults can depend on the CLI version and configuration, so check the live session rather than assuming a fixed setting. See the Codex CLI guide.
Codex Cloud is a separate runtime: coding tasks run on OpenAI-managed computers in reusable cloud environments. Workspace cloud-access settings govern whether a member can use cloud tasks, while creating or editing shared environments requires an additional workspace-management permission. Local access and cloud access should therefore be checked independently. OpenAI explains these controls in Using Codex with your ChatGPT plan.
OpenAI’s description of its Codex safety architecture covers sandbox boundaries for writes, network access, and protected paths. It also describes agent-oriented logging that can include prompts, approval decisions, execution results, MCP use, and network-policy events. Those are OpenAI’s descriptions of its own platform, not a standard feature list for all coding agents. See Running Codex safely at OpenAI.
Claude Code
Anthropic’s FAQ says users can add a Read deny rule in .claude/settings.json to block selected files; a denied file cannot be read even if requested. It also describes permission modes: in acceptEdits, file edits proceed without a prompt, while shell commands, network calls, and actions outside the working directory still require a prompt. The FAQ recommends default mode for tighter control. Verify the current product settings and documentation before relying on a particular mode.
Rank #4
Gemini Code Assist agent mode
Google documents context sources that vary by IDE and settings, and a context drawer for seeing what is available to the agent. Because tool responses can become part of the agent’s interaction with the Gemini API, the relevant check is not only which files are in context but which tools can be called and what they return. See Google’s agent mode overview for the documented IDE-specific sources.
What to compare when auditing an agent
When assessing an agent for a project, compare the configured session—not just the model or product name—against these practical criteria:
Best Value
- Context sources: workspace files, indexed symbols, attached files, prompt content, tool results, URLs, MCP servers, and app integrations.
- Read and write boundaries: readable paths, writable roots, and explicit deny rules.
- Execution authority: command approval, shell access, network access, and how sandbox limits apply to commands the agent starts.
- Runtime location: local machine versus provider-managed environment, including repositories, credentials, and network routes available there.
- Inspection and audit: context drawer, session permissions, command and diff review, and activity logs, where available.
- Data handling: what the vendor says is read locally, sent to its service, retained, or governed by your plan and organization terms.
Product controls, defaults, and documentation can change. For a sensitive project, check the current documentation and the settings of the exact surface you intend to use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
